Техническая информация
- [<HKLM>\SOFTWARE\Classes\iexploreFile\shell\open\command] '' = '<SYSTEM32>\WScript.exe "%1" %*'
- '<SYSTEM32>\wscript.exe' <Текущая директория>\Killme.vbs
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.58##la.com/?by##
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\58lala[1]
- <Текущая директория>\Killme.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\launch internet explorer browser.iexplore
- <Текущая директория>\Killme.vbs
- 'localhost':1039
- 'www.58##la.com':80
- 'localhost':1036
- 'u.###6688.com':80
- http://u.###6688.com/t.txt
- http://www.58##la.com/?by##
- http://u.###6688.com/dom2.txt
- http://u.###6688.com/type.txt
- DNS ASK www.58##la.com
- DNS ASK u.###6688.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''